Security audit

Cross-Agent Memory Sharing

Security checks across malware telemetry and agentic risk

Overview

This skill is meant to share agent memory, but running it can upload local memory to a Git repository and its command handling is unsafe.

Review carefully before installing or running. Use only a private repository you control, inspect and redact MEMORY.md first, and avoid push or sync until the script uses safe argument-based git execution and asks for explicit approval before exporting or pushing memory.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script accepts a repository URL from an environment variable and interpolates it directly into a shell command via execSync. This enables shell command injection if SHARED_MEMORY_REPO is attacker-controlled, and even without injection it grants broad exfiltration/synchronization capability to an arbitrary remote repository beyond what a minimal memory-sync helper should do.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The tool reads local MEMORY.md and pushes its contents to a remote repository with no explicit consent, review step, redaction, or warning. In an agent environment, memory files often contain prompts, secrets, internal notes, or sensitive workspace data, so this creates a clear exfiltration risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The repository URL is environment-controlled and then executed through a shell-based git clone command without validation. This combines command-injection risk with unreviewed network access to arbitrary remotes, making the skill materially more dangerous in automated agent contexts.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The protocol explicitly treats user-input as a preferred memory source and describes propagating those memories across agents. That creates a direct cross-agent data leakage channel where sensitive user data, secrets, or prompt-injected content can be retained and redistributed far beyond the original interaction scope.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The Git-based workflow encourages agents to commit learned knowledge into a shared repository, but it provides no controls to prevent committing sensitive user-derived content, credentials, or proprietary data. Once pushed, such data can persist in commit history and be replicated to all agents with repository access, amplifying exposure and making remediation difficult.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: sync.mjs:21